dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs: authentik/anubis/network corrected to live-verified outpost behavior

Browse Source 
Meta-header routing and forward_auth removed from the described design — both
disproved live. Documents: Host-based provider routing with per-guarded-host
proxy providers (lockstep rule), the null-flows wedge that starves the
embedded outpost config fetch, the Anubis /outpost.goauthentik.io/* transport
exemption, the single-file bind-mount stale-policy inode gotcha, Invalid next
URL as a dead design, and the public-DNS record requirement per guarded host.
This commit is contained in:
Frank
2026-08-29 23:55:48 -07:00
parent 2a72efad44
commit ee1e038f30
3 changed files with 116 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Architecture/Network Architecture.md
+16 -10
View File
@@ -7,8 +7,12 @@ One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143)
As of 2026-08-28 the front door is a two-tier chain: Caddy terminates TLS,
Anubis verifies the client (DENY known AI scrapers, CHALLENGE everyone
else), and accepted traffic returns to Caddy's internal listener on `:8016`,
where per-vhost routing resumes. Authentik's outpost then gates the wrapped
apps with `forward_auth`. See [[Anubis]] and [[Authentik]].
which proxies every request whole to the Authentik server with the Host
header preserved; Authentik's embedded outpost routes on that Host against
each proxy provider's `external_host`, serves the login flow in place for
sessionless clients, and forwards authenticated traffic back to Caddy's
post-auth listener `:8017`, where per-vhost routing reaches the app. See
[[Anubis]] and [[Authentik]].
```mermaid
graph TB
@@ -19,12 +23,13 @@ graph TB
CADDY -->|unwrapped vhosts route direct| DIRECT{direct routes}
CADDY -->|guarded vhosts| ANUBIS[Anubis verify :8923]
ANUBIS -->|deny AI bots| EXT
ANUBIS -->|challenge solved or bypassed| INT[Caddy internal listener :8016]
INT -->|forward_auth outpost| AUTH[Authentik server :9000 loopback]
INT --> HOME[Homepage file_server]
INT --> SEARCH[SearXNG via Gluetun netns :8081]
INT --> HERMES[Hermes :8090]
INT --> PROM[Prometheus :9090]
ANUBIS -->|challenge solved or transport-exempt| INT[Caddy internal listener :8016]
INT -->|whole request, Host preserved| AUTH[Authentik embedded outpost :9000]
AUTH -->|session valid, provider internal_host| POST[Caddy post-auth listener :8017]
POST --> HOME[Homepage file_server]
POST --> SEARCH[SearXNG via Gluetun netns :8081]
POST --> HERMES[Hermes :8090]
POST --> PROM[Prometheus :9090]
DIRECT -->|3000 + ssh 2222| GITEA[Gitea]
DIRECT -->|3005| OWEBUI[OpenWebUI]
DIRECT -->|3002| GRAFANA[Grafana :3000]
@@ -43,7 +48,8 @@ graph TB
ARR[*arr stack + qBittorrent]
end
INT -->|romm, files guarded paths| ROMM
POST -->|romm| ROMM
POST -->|files| COPY
DIRECT -->|plex plain-HTTP passthrough| PLEX
DIRECT --> CAL
DIRECT --> JEL
@@ -77,7 +83,7 @@ SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetu
## Access Policy
- The **G36 router firewall** governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
- Access is layered: Anubis challenges/denies bots at the front door, then Authentik's embedded outpost (`forward_auth`) gates the wrapped apps. Apps with their own login (Grafana, Gitea, Plex) run unwrapped. See [[Anubis]] and [[Authentik]].
- Access is layered: Anubis challenges/denies bots at the front door, then Authentik's embedded outpost (whole-request proxy, routed by `Host` → provider `external_host`) gates the wrapped apps — one proxy provider per guarded host is mandatory, and Anubis exempts the `/outpost.goauthentik.io/*` transport paths so login can happen before a challenge cookie exists. Apps with their own login (Grafana, Gitea, Plex) run unwrapped. See [[Anubis]] and [[Authentik]].
- LAN subnet: `192.168.0.0/24`.
## See Also